kentonv

32 ms·

391.
by kentonv 1y ago
That's me. I'm the expert. On my very most productive days of my entire career I've managed to produce ~1000 lines of code. This library is ~5000 (including comments, tests, and documentation, which you omitted for some reaso
392.
by kentonv 1y ago
> This workers-oauth-provider project is 1200 lines of code. An expert should be able to write that on the scale of an hour. Are you being serious here? Let's do the math. 1200 lines in a hour would be one line every three seconds,
393.
by kentonv 1y ago
https://news.ycombinator.com/item?id=44159167
394.
by kentonv 1y ago
Came here because I had the same reaction but also can't be bothered to test so was hoping someone else did. Guess we'll just never know for sure, lol.
395.
by kentonv 1y ago
I'm not aware of any other OAuth provider libraries for Workers. Plenty of clients, but not providers -- implementing the provider side is not that common, historically. See my other comment: https://news.ycombinator.com&#x2
396.
by kentonv 1y ago
Yep. I screwed this up. It's super-embarrassing because I had actually made a note to myself to verify this exact behavior and yet, somehow, I failed to do so.
397.
by kentonv 1y ago
I find reviewing AI code less mentally tiring that reviewing human code. This was a surprise to me! Until I tried it, I dreaded the idea. I think it is because of the shorter feedback loop. I look at what the AI writes as it is writing it,
398.
by kentonv 1y ago
I am also not a lawyer, but I believe the law here is yet to be fully settled. Here in the US, there have been lower-court rulings but surely it will go to the supreme court. There are parts of the library that I did write by hand, which ar
399.
by kentonv 1y ago
I've noticed this too. I remember hearing somewhere that humans have a limited capacity in terms of number of decisions made in a day, and it seems to fit here: If I'm writing the code myself, I have to make several decisions on e
400.
by kentonv 1y ago
Yeah I was disappointed in that one. I hate to say, though, but I have reviewed a lot of human code in my time, and I've definitely caught many humans making similar-magnitude mistakes. :/
401.
by kentonv 1y ago
env.OAUTH_KV.get(...) is reading from Workers KV storage. It returns a promise.
402.
by kentonv 1y ago
Other way around. I pushed myself to try this, and then based on the result ended up pushing the company to adopt AI more.
403.
by kentonv 1y ago
I replied there: https://news.ycombinator.com/item?id=44165668
404.
by kentonv 1y ago
I think the data supports that there were about 5 distinct days when I did a large amount of work on this library, and a sprinkling of minor commits through the rest of the month. Glen's commits, while numerous, were also fairly minor,
405.
by kentonv 1y ago
> Even the recently posted Cloudflare OAuth worker codebase took ~3 months to release (8 Mar - 20 May) This is incorrect. The library was part of the MCP framework we launched on March 25 -- the same month development began: https:&#x2F
406.
by kentonv 1y ago
What are you talking about? The entire library is 2600 lines. There are no 2500-line methods.
407.
by kentonv 1y ago
As it happens, if this were released a month later, it would have been a huge loss for us. This OAuth library is a core component of the Workers Remote MCP framework, which we managed to ship the day before the Remote MCP standard dropped
408.
by kentonv 1y ago
While implementing the OAuth standard itself is not novel, many of the specific design details in this implementation are. I gave it a rather unusual API spec, an unusual storage schema, and an unusual end-to-end encryption scheme. It was t
409.
by kentonv 1y ago
I didn't keep extract track but I'd estimate the total cost of Claude credits to build this library was somewhere around $50, which is pretty negligible compared to the time saved.
410.
by kentonv 1y ago
Yes! We're about to enter a world where everyone has their own custom software for their specific use cases. Each of these is relatively simple, yet they may replace something complex. Excel is complex because it needs to handle everyo
411.
by kentonv 1y ago
> However if you're not an experienced programmer you won't know what's missing, if it's using outdated and insecure options, or is just badly written. This still needs a professional. I think a lot of this could be s
412.
by kentonv 1y ago
Learning a prefix of the hash doesn't really get you anywhere. The hash itself isn't a secret -- it could be published publicly without breaking the security model. You still need to derive a token that hashes to that value in ful
413.
by kentonv 1y ago
> I think we'll actually see (maybe) individual employees solving some of these problems on their own without involving IT/the dev team. I agree, but in my book, those employees are now developers. And so by that definition, th
414.
by kentonv 1y ago
There are good arguments to just conform. But it is in fact true nevertheless that many companies and teams continue to choose bespoke workflows over standardized ones. So I guess there must be something driving that. I don't actually
415.
by kentonv 1y ago
I suppose it's all a continuum and we can each have different opinions on what the threshold for "glorified markov generator" is. But there have been many cases in my experience where the LLM could not possibly have been simp
416.
by kentonv 1y ago
I used Claude Code. I actually just asked it what tools I needed for a CLI-driven build, and it told me what to install (or even installed it for me in some cases). I basically didn't read any documentation, just asked Claude what I sh
417.
by kentonv 1y ago
This library helps implement both the resource server and authorization server. Most people understand these two things to be, collectively, the "provider" side of OAuth -- the service provider, who is providing an API that requir
418.
by kentonv 1y ago
I admit I have no specific knowledge of accounting and just meant to reference any random department that isn't engineering. (Though I think it's true of engineering too. We all have our own weird team-specific processes for code
419.
by kentonv 1y ago
It's certainly true that my own recall of the code would be better if I had written it by hand. But I don't think the final code is all that far off from what I would have written.
420.
by kentonv 1y ago
The secret token is hashed first, and it's the hash that is looked up in storage. In this arrangement, an attacker cannot use timing to determine the correct value byte-by-byte, because any change to the secret token is expected to ran

More ›